If I am running a modified version of "finger", is that an exposure?
I could have a modified version that returns false information, or a
canned message about who to contact for info.
I would argue that simply have a running server for finger, or rwho,
or any of the other things is not the exposure.
--spaf